10, 9, 8, 7, 6, 5, 4, 3, 2, 1

not ‘voice’. The VMS Phone facility enabled the worm to send messages to users. It would simply call them using the phone protocol. But instead of starting a chat session, it sent them state- ments from what was later determined to be the aptly named Fortune Cookie file – a collection of 60 or so pre-programmed comments.

In some cases, where the worm was really bugging staff, McMahon told the manager at the other end of the phone to turn the computer’s Phone feature off. A few managers complained and McMahon gave them the obvious ultimatum: choose Phone or peace. Most chose peace.

When McMahon finished his preliminary analysis, he had good news and bad news. The good news was that, contrary to what the worm was telling computer users all over NASA, it was not actually deleting their files. It was just pretending to delete their data. One big practical joke. To the creator of the worm anyway. To the NASA scientists, just a headache and heartache. And occasionally a heart attack.

The bad news was that, when the worm got control over a privileged account, it would help someone – presumably its creator – perpetrate an even more serious break-in at NASA. The worm sought out the FIELD account created by the manu- facturer and, if it had been turned off, tried to reactivate the account and install the password FIELD. The worm was also programmed to change the password for the standard account named DECNET to a random string of at least twelve char- acters. In short, the worm tried to pry open a backdoor to the system.

The worm sent information about accounts it had success- fully broken into back to a type of electronic mailbox – an account called GEMPAK on SPAN node 6.59. Presumably, the hacker who created the worm would check the worm’s mailbox for information which he could use to break into the NASA account at a later date. Not surprisingly, the mailboxes had been surreptitiously ‘borrowed’ by the hacker, much to the surprise of the legitimate owners.